Antes da restauração é preciso desmontar a partição aonde se encontravam os arquivos a serem restaurados. Todos os comandos serão executados com o usuário root.

# umount /dev/sda4 /media/backup (exemplo)

Agora veremos as opções do comando "ext3grep".

# ext3grep -h

Running ext3grep version 0.8.0
ext3grep: invalid option -- h
No action specified; implying --superblock.

Usage: ext3grep [options] [--] device-file
Options:
  --version, -[vV]       Print version and exit successfully.
  --help,                Print this help and exit successfully.
  --superblock           Print contents of superblock in addition to the rest.
                         If no action is specified then this option is implied.
  --print                Print content of block or inode, if any.
  --ls                   Print directories with only one line per entry.
                         This option is often needed to turn on filtering.
  --accept filen         Accept "filen" as a legal filename. Can be used multi-
                         ple times. If you change any --accept you must remove
                         BOTH stage* files!
  --journal              Show content of journal.
  --show-path-inodes     Show the inode of each directory component in paths.
Filters:
  --group grp            Only process group "grp".
  --directory            Only process directory inodes.
  --after dtime          Only entries deleted on or after "dtime".
  --before dtime         Only entries deleted before "dtime".
  --deleted              Only show/process deleted entries.
  --allocated            Only show/process allocated inodes/blocks.
  --unallocated          Only show/process unallocated inodes/blocks.
  --reallocated          Do not suppress entries with reallocated inodes.
                         Inodes are considered "reallocated" if the entry
                         is deleted but the inode is allocated, but also when
                         the file type in the dir entry and the inode are
                         different.
  --zeroed-inodes        Do not suppress entries with zeroed inodes. Linked
                         entries are always shown, regardless of this option.
  --depth depth          Process directories recursively up till a depth
                         of "depth".
Actions:
  --inode-to-block ino   Print the block that contains inode "ino".
  --inode ino            Show info on inode "ino".
                         If --ls is used and the inode is a directory, then
                         the filters apply to the entries of the directory.
                         If you do not use --ls then --print is implied.
  --block blk            Show info on block "blk".
                         If --ls is used and the block is the first block
                         of a directory, then the filters apply to entries
                         of the directory.
                         If you do not use --ls then --print is implied.
  --histogram=[atime|ctime|mtime|dtime|group]
                         Generate a histogram based on the given specs.
                         Using atime, ctime or mtime will change the
                         meaning of --after and --before to those times.
  --journal-block jblk   Show info on journal block "jblk".
  --journal-transaction seq
                         Show info on transaction with sequence number "seq".
  --dump-names           Write the path of files to stdout.
                         This implies --ls but suppresses it's output.
  --search-start str     Find blocks that start with the fixed string "str".
  --search str           Find blocks that contain the fixed string "str".
  --search-inode blk     Find inodes that refer to block "blk".
  --search-zeroed-inodes Return allocated inode table entries that are zeroed.
  --inode-dirblock-table dir
                         Print a table for directory path "dir" of directory
                         block numbers found and the inodes used for each file.
  --show-journal-inodes ino
                         Show copies of inode "ino" still in the journal.
  --restore-inode ino[,ino,...]
                         Restore the file(s) with known inode number "ino".
                         The restored files are created in ./RESTORED_FILES/
                         with their inode number as extension (ie, inode.12345).
  --restore-file "path"  Will restore file "path". "path" is relative to root
                         of the partition and does not start with a "/" (it
                         must be one of the paths returned by --dump-names).
                         The restored directory, file or symbolic link is
                         created in the current directory as ./"path".
  --restore-all          As --restore-file but attempts to restore everything.
                         The use of --after is highly recommended because the
                         attempt to restore very old files will only result in
                         them being hard linked to a more recently deleted file
                         and as such polute the output.
  --show-hardlinks       Show all inodes that are shared by two or more files.

Procuraremos no device (/dev/sda4) onde se encontravam os arquivos com a opção "--search" no diretório "06-Usuários", que notamos que tinha sido apagado.

# ext3grep /dev/sdb4 --search 06-Usuários
Running ext3grep version 0.8.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 1596
Minimum / maximum journal block: 26083842 / 26117157
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1287884824 = Sat Oct 23 23:47:04 2010
Journal transaction 468 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 27683; min / max sequence numbers: 257 / 6042
Blocks containing "06-Usuários": 4917248 (allocated) 26110317 (allocated) 26111049 (allocated) 26112321 (allocated) 26113419 (allocated) 26115667 (allocated)

Como depois de ter apagado acidentalmente os arquivos e não feito mais nada na partição em questão, procuraremos pelo último "bloco" alocado provavelmente tendo 100% de sucesso.

# ext3grep /dev/sdb4 --ls --block 26115667
Running ext3grep version 0.8.0
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
Number of groups: 1596
Minimum / maximum journal block: 26083842 / 26117157
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1287884824 = Sat Oct 23 23:47:04 2010
Journal transaction 468 wraps around, some data blocks might have been lost of this transaction.
Number of descriptors in journal: 27683; min / max sequence numbers: 257 / 6042
Group: 796

Block 26115667 is a directory. The block is a Journal block

          .-- File type in dir_entry (r=regular file, d=directory, l=symlink)
          |          .-- D: Deleted ; R: Reallocated
Indx Next |  Inode   | Deletion time                        Mode        File name
==========+==========+----------------data-from-inode------+-----------+=========
   0    1 d 1228801                                         drwxr-xr-x  .
   1    2 d       2                                         drwxr-xr-x  ..
   2    3 d 1228802                                         drwxrwxrwx  11-Filmes
   3    4 d 1228920                                         drwxrwxrwx  01-Biblioteca
   4    5 d 1229154                                         drwxrwxrwx  02-Currículos
   5    6 d 1229171                                         drwxrwxrwx  03-Fotos
   6    7 d 4047372                                         drwxrwxrwx  05-Músicas
   7    8 d 5251448  D 1289089604 Sat Nov  6 22:26:44 2010  drwxrwxrwx  06-Usuários
   8    9 d 5252816                                         drwxrwxrwx  10-Windows
   9   10 d 5424119  D 1289089624 Sat Nov  6 22:27:04 2010  drwxrwxrwx  12-Documentários
  10   11 d 5424151                                         drwxrwxrwx  04-Linux
  11  end d 5653482                                         drwxrwxrwx  07-Vídeos_comedias

WARNING: inode 1228801 was reallocated!

Podemos ver com o resultado do comando acima que o "D" foram os diretórios que foram apagados.

Agora que sabemos os "inodes" referentes a cada diretório apagado, poderemos fazer a devida recuperação com o comando "ext3grep /dev/sdb4 --restore-inode 5251448", mas como notei que alguns arquivos dos diretórios que não foram apagados tinham sido perdidos, fui eu para restauração de todos:

# ext3grep /dev/sda4 --restore-all

Agora é só esperar porque o processo de restauração demorará mais ou menos 2 horas (isto no meu caso).

Depois do processo demorado, tudo ocorreu bem. Agora é só ir na pasta chamada "RESTORED_FILES" no diretório atual onde foi executado o comando e organizar com suas necessidades.

Graças a minha persistência de 5 dias corridos direto tentando uma forma de restauração, tive até que comprar um HD com tamanho maior que a partição de "backup" para poder fazer a restauração de todos os arquivos. Mais isso foi um opção minha para não estragar toda a estrutura das partições no HD onde se encontrava o "backup".

Então é isso.

Até a próxima.